Analysis

  • max time kernel
    151s
  • max time network
    167s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/02/2024, 12:56

General

  • Target

    blur-installer.exe

  • Size

    56.0MB

  • MD5

    cc8d0921084401992c3f84cf6db0a9a5

  • SHA1

    0f85447fa43ba0d77d60e857ed238f046347c4c5

  • SHA256

    adeb24697fb2c829c513f1812aa5645717640599a5aeb964d45ec616e0ebd6b6

  • SHA512

    dc662cfb40416553cad0738fe4c7407f3b04457f47bd766832a694f896e5834956eefe5bacce32022de33bca1a637e85f589479fe38b89b03ef259439753e644

  • SSDEEP

    1572864:njXb31SEpfRrEE1sioTNq9ikYyjgL7c31nppNOnFMQi:njx1J7+ioyikY+gH41nppNlH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\blur-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\blur-installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Users\Admin\AppData\Local\Temp\is-KQ9NE.tmp\blur-installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KQ9NE.tmp\blur-installer.tmp" /SL5="$701F0,57819947,879104,C:\Users\Admin\AppData\Local\Temp\blur-installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3696
      • C:\Users\Admin\AppData\Local\Temp\is-QQHG3.tmp\VC_redist.x86.exe
        "C:\Users\Admin\AppData\Local\Temp\is-QQHG3.tmp\VC_redist.x86.exe" /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2860
        • C:\Windows\Temp\{2381BD94-3FFC-4449-8BF8-EB929F1BC4CB}\.cr\VC_redist.x86.exe
          "C:\Windows\Temp\{2381BD94-3FFC-4449-8BF8-EB929F1BC4CB}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-QQHG3.tmp\VC_redist.x86.exe" -burn.filehandle.attached=512 -burn.filehandle.self=592 /install /passive /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4292
  • C:\Users\Admin\AppData\Local\Programs\blur\blur.exe
    "C:\Users\Admin\AppData\Local\Programs\blur\blur.exe"
    1⤵
    • Executes dropped EXE
    PID:3748
  • C:\Windows\System32\GamePanel.exe
    "C:\Windows\System32\GamePanel.exe" 0000000000050302 /startuptips
    1⤵
    • Checks SCSI registry key(s)
    PID:5040
  • C:\Windows\System32\bcastdvr.exe
    "C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
    1⤵
    • Drops desktop.ini file(s)
    PID:1364
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.0.1803282022\542066062" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7843df53-c2cc-49ae-ac5b-887a8cc276b3} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 1764 1ed9e7c6158 gpu
        3⤵
          PID:536
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.1.1532880333\1948705008" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18f58535-55d9-4b6c-9860-52bc0d9eb302} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2120 1ed93772558 socket
          3⤵
            PID:1388
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.2.859217442\1848183759" -childID 1 -isForBrowser -prefsHandle 2684 -prefMapHandle 2476 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd41d519-ea54-4fb6-bdf0-3d7e1375fa3c} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2648 1eda299a358 tab
            3⤵
              PID:4316
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.3.1282875821\900084500" -childID 2 -isForBrowser -prefsHandle 3608 -prefMapHandle 3604 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf53f751-3dc1-4e4d-84af-7328cbcf5fd3} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3616 1eda0eed458 tab
              3⤵
                PID:1892
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.4.1424246223\1165099986" -childID 3 -isForBrowser -prefsHandle 4244 -prefMapHandle 4240 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aeedf832-70e8-457d-aab1-a3e56516e9fc} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 4256 1eda3fb5e58 tab
                3⤵
                  PID:3576
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.7.1621718520\747355339" -childID 6 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d409d0c-8040-42c4-9b63-4b9467577dcf} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5180 1eda52d2b58 tab
                  3⤵
                    PID:4752
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.6.2074958103\1846279875" -childID 5 -isForBrowser -prefsHandle 872 -prefMapHandle 4864 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {110cc69c-7032-49b7-b403-c10b1c9ee9de} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5012 1eda52d2258 tab
                    3⤵
                      PID:4236
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.5.173323477\1925078605" -childID 4 -isForBrowser -prefsHandle 4980 -prefMapHandle 4888 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88ac1f1c-ab78-4d33-b2d0-15dbd6bac7b8} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 4992 1eda2f2fd58 tab
                      3⤵
                        PID:4788
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.8.488058256\1810307377" -childID 7 -isForBrowser -prefsHandle 5232 -prefMapHandle 5228 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {65e51290-4830-4693-ad95-cb0c13721b5c} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2944 1eda0f37e58 tab
                        3⤵
                          PID:3544
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.9.316192920\141968595" -parentBuildID 20221007134813 -prefsHandle 4148 -prefMapHandle 4300 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55e7ef06-8115-4805-baea-1b68a34cd1b9} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5688 1eda6813258 rdd
                          3⤵
                            PID:5724

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n69gspjk.default-release\cache2\entries\CF41242232969F78723EDD0088C6DF5923767BEF

                        Filesize

                        165KB

                        MD5

                        732163c80bc6fdf469d3f259897e995e

                        SHA1

                        e7ce9db8fe3b6cc9cd70e4654b4ded056b3afb00

                        SHA256

                        a3170c8d4256f48a494870cad175c915452b8032f75af61fc56455459dd5ff7c

                        SHA512

                        830ef46069d7aa005a61bf4e866dc23728c9771f948c3d185bc084d39906b9eb7edb2637e64a39458fab13abcfdc112b3655ce076d0643b2de601e870b40a96c

                      • C:\Users\Admin\AppData\Local\Programs\blur\blur.exe

                        Filesize

                        397KB

                        MD5

                        d470bb711f85eaec8050229432474943

                        SHA1

                        932d7a1ef54792ad0917f60dac4785c460da1758

                        SHA256

                        1a6a5f6b82f9e8978c8599a84961f1df5b926b2fc10897f2868d58554de06e58

                        SHA512

                        d065d93795d2ae354a7bca94f99350136e1ee2db312643e2ea7652af8d467d1265947c67e83eadfb31a1b623af738e0b537ebd8e67d2c1a5401aea8eef103d70

                      • C:\Users\Admin\AppData\Local\Programs\blur\lib\vapoursynth\Lib\site-packages\setuptools-58.0.4.dist-info\is-8OSCU.tmp

                        Filesize

                        4B

                        MD5

                        365c9bfeb7d89244f2ce01c1de44cb85

                        SHA1

                        d7a03141d5d6b1e88b6b59ef08b6681df212c599

                        SHA256

                        ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                        SHA512

                        d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                      • C:\Users\Admin\AppData\Local\Programs\blur\lib\vapoursynth\Lib\site-packages\wheel\vendored\packaging\is-B5QCU.tmp

                        Filesize

                        1KB

                        MD5

                        b0dac8ef6953fb835c7d633e6a427ba7

                        SHA1

                        f521b39e0501e178412d557ac85d625626b85326

                        SHA256

                        c79f44850e7b4cc4fe9134722d9576e4766f6061b06ee713a3a88a87f3b4b4cc

                        SHA512

                        de5d2189075a26dc2e9ba41c1bbf2d4ccd3d5fb475802a0d7a70e311a301c4c4cb619d9f15c6263a420583b4f8bf87fcd589d6f96fe7b1edc367b875d54cfdda

                      • C:\Users\Admin\AppData\Local\Programs\blur\lib\vapoursynth\Scripts\is-KHRCR.tmp

                        Filesize

                        103KB

                        MD5

                        449919a8dbc0882ab75fbeb012634dd7

                        SHA1

                        c457948d731f7d414a0f06a75c348d4035b19c86

                        SHA256

                        f5ddfb8a27580e38c964a5455704a51df94e3796723ba145ed8ac44734110e93

                        SHA512

                        0d0d94e063d6c49c4e4fc8e1dd933e6a4acca48cd875d274543a134b849f0db2aa5f92826c0dc3f728817b9adf005947ca0f94c878ae139ac9d372518c43fb91

                      • C:\Users\Admin\AppData\Local\Temp\is-KQ9NE.tmp\blur-installer.tmp

                        Filesize

                        741KB

                        MD5

                        eb379f6fd094dbbcf0f0a39fe5b23fc2

                        SHA1

                        4ad6763f4f1b0038cca888636bf5e98a038ec56b

                        SHA256

                        47da3a00e470ceaf568af9f7225e723a682f99813e8c10110a1bdc997c8232ef

                        SHA512

                        a0538befcdd59916b0942379238d39cce3eb1ddef0143cbbe102bedeae9ebfdcf35584ff8db361032d3b98e7b7020685af4d629ec896ab6a483ab7e2e7053dc0

                      • C:\Users\Admin\AppData\Local\Temp\is-KQ9NE.tmp\blur-installer.tmp

                        Filesize

                        3.1MB

                        MD5

                        4c1da6e07f377da9421c0bd4cc33ac72

                        SHA1

                        d7b292b13008e485fdb69f44d7e4ed15fea9a221

                        SHA256

                        dea7aef5837642ed3243e95ec640b6404f06a8fbe210a82ebdbc76859c57c3c8

                        SHA512

                        555559c738e2db80405b1a486403f1c384d291dfc3b526290b9d50f5796f76bb6a8e85e1d99c5f9fa022b4c06994c20ceba55bf6eaa6d0b9e81f3893c4a14cef

                      • C:\Users\Admin\AppData\Local\Temp\is-QQHG3.tmp\VC_redist.x86.exe

                        Filesize

                        13.1MB

                        MD5

                        1fb0faba3d602afe03740db3d145c1e6

                        SHA1

                        2c1ae47103e7f8d6072df4a8d9ceb382724ac59b

                        SHA256

                        1acd8d5ea1cdc3eb2eb4c87be3ab28722d0825c15449e5c9ceef95d897de52fa

                        SHA512

                        4509cfbd5f08cc32d68855edc285e8ba8caa7d2c4d044e4256dd907b205fda9a689c32ad7ef9ff3955e8390ed67498a54039a3cd4bfc9102ed82f9bd1255011a

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n69gspjk.default-release\datareporting\glean\db\data.safe.bin

                        Filesize

                        2KB

                        MD5

                        ea99aa79108ecd58ce29378e4f7145b6

                        SHA1

                        1fe7c80951bc5ae0c909e1273aa68cb4b1f4c9bb

                        SHA256

                        b745620bf227a574e68a9fca9d2047fe2d5f2a9575cab88c494261e539b44875

                        SHA512

                        4292815b1990414662203a7f1f4ec5d3c0d627708fd3eb45c64f8964df2080d3e910248d207cfb5bdd1704cae81b7413eabec5ddc8145ad37e6a9f4e9b760f35

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n69gspjk.default-release\datareporting\glean\pending_pings\7245ab10-804f-4537-95c5-3d7c5f8f2b4f

                        Filesize

                        746B

                        MD5

                        172c81478344ef290befcf6898cab840

                        SHA1

                        28ee914af1fc2ad859e38b728eb89cc98ef4a512

                        SHA256

                        b09add4ab74cc8a762d8020970154dfd8ad744433e93d63fe8a841ea0ad98d43

                        SHA512

                        f4036b10ec6321db68566671c96e56a70f635edf32d453e401d670026744c13b1d80eebd8d69724c1b80836dfd0d904a5ad9f758aba80302d8f454ab2177eda9

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n69gspjk.default-release\datareporting\glean\pending_pings\8ecee561-19b9-44ee-9baa-85db46eb501d

                        Filesize

                        11KB

                        MD5

                        124fa0c436537770d4d6ec6c1eb9fc6d

                        SHA1

                        3059316cc8e84dc37b05b8563ca669d9ced2de88

                        SHA256

                        7ef09c0eacd87096d392a7667fcf48580df9e378796d260c67c924ca3f035f4d

                        SHA512

                        0b69fed39958b3ba075608b42f85c8ad172e7e933a6258929cb7e9b1b220db421c8207d3cc15cee553d297b744df69aab0777b36d707d8e0a15e2b3f3d96770d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n69gspjk.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        8e24fd6ce6083ec4edd037fe382de0f5

                        SHA1

                        6e21c3c567263154b58633fcb4676368a81ad342

                        SHA256

                        74c06111105123a746c0e36125d47dc91f68abc684499cad114ca9d1da3a4c30

                        SHA512

                        79308fcd3e9e752eaecd631f57e37c2d0bcda242b5ee6e8e43033c92cf1df72873a2c966787a1bf5e572d9de368fdc91727e4e50852061cd6fde8349dc1ef79c

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n69gspjk.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        14d9f50e5013bd6bd86e8c6df80f58f3

                        SHA1

                        3fccd0e2b051439e3ed706f93e80ffa9fabec288

                        SHA256

                        8cf7ec28e67bda8fd7eae0ed40b5800c0de9cd462b8c0ab4b429bb8745c1ff6c

                        SHA512

                        b1a337930c1b2a92586cd8251c0b60b671972768f2d035133db000853de3101dadc182806d24f786d3c8bb8be6e287ec3d5eeef476e261041f0378c00a8b96c9

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n69gspjk.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        4KB

                        MD5

                        c10a86f4da837b8ac6a641353c3c6bd8

                        SHA1

                        bddc4c4a1ddc85f2fd249168fbd2f86c7a679bb8

                        SHA256

                        024e0b52eab483c0c39faf1759478408ad586e2794fa94b3743bb5c967d3b65f

                        SHA512

                        722516fc79e26535ca0c2c0e2eac8e509d30b86224e725c99bb74d15e182c24b9a3c1f26ed4384bc9c76ffe446618cb9e3fcfc9e0ddae51ff14db9ae92c6bb70

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n69gspjk.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        1KB

                        MD5

                        104b66589c6b60264a5dee8955d61662

                        SHA1

                        4cb37974b78b241947316f465f92c30699e98ef8

                        SHA256

                        cebf3b6b7d3d4e1efe46edf8cf0680d1a4714ed2d3a56e7605381323784b8b21

                        SHA512

                        106dd1e016db38542328740aae58707636e4ce6f0f287a3bda1e69f74b1748aa723b72050446742aee54196b1d3de89761c5c35de46921d8e755ef8935dab67c

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n69gspjk.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        6KB

                        MD5

                        46196aa90395be7d3bbb50976d2eb0dc

                        SHA1

                        5ff13e19b4dc1b2f40b0da2c8c000c3cca70e5c0

                        SHA256

                        21cb449658c5363cf1027cc6531b6f61fcf48d6ba6852f353d74680859b9befc

                        SHA512

                        0faf6cdc620f4bd663c3c5c3ca7322f5438fc1f680db0ee50b0cdfa3904a8c62d180988941594fdb7bca7b9a76ce9208ffe51338c8901c94483b691b28c5faf6

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n69gspjk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                        Filesize

                        184KB

                        MD5

                        9eb79b3d53e352ef92c5c86a1b24ff21

                        SHA1

                        5932783b9840865da29a071ba4811377f5bd7579

                        SHA256

                        06969407bf1c51fb2bbba374b6b6c721223ab54503f2abccb5978e5154d57df5

                        SHA512

                        05fd360b46862dd9817e87b966bcc91858ebb7773a5695b1bbf4647d3d8d72b8c75e20bdc97b8e82bb63cda1abf4c4d25422d72847f16e28630ba723dda46335

                      • C:\Users\Admin\Videos\Captures\desktop.ini

                        Filesize

                        190B

                        MD5

                        b0d27eaec71f1cd73b015f5ceeb15f9d

                        SHA1

                        62264f8b5c2f5034a1e4143df6e8c787165fbc2f

                        SHA256

                        86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

                        SHA512

                        7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

                      • C:\Windows\Temp\{2381BD94-3FFC-4449-8BF8-EB929F1BC4CB}\.cr\VC_redist.x86.exe

                        Filesize

                        632KB

                        MD5

                        1636039e4940c80acaeb369852f79cef

                        SHA1

                        7d2b5110d1bf729d7fcd9e42a2b01a58dcc66a69

                        SHA256

                        d116ecd1f04402430eb8ff5e07357f7ab2a2e0aa12dd6c5156e7f92705568e0e

                        SHA512

                        3ba5c3225b74594d6121a45f225204e8eb4b80afc60849fe78a933afcc81f8db7221cdcbe5789ade1b3f2d784dc3659c08692f7bd808b85198cb78e601d8da02

                      • C:\Windows\Temp\{67ACBF3F-D997-4E50-8D51-68EDC264D10B}\.ba\logo.png

                        Filesize

                        1KB

                        MD5

                        d6bd210f227442b3362493d046cea233

                        SHA1

                        ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

                        SHA256

                        335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

                        SHA512

                        464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

                      • \Windows\Temp\{67ACBF3F-D997-4E50-8D51-68EDC264D10B}\.ba\wixstdba.dll

                        Filesize

                        191KB

                        MD5

                        eab9caf4277829abdf6223ec1efa0edd

                        SHA1

                        74862ecf349a9bedd32699f2a7a4e00b4727543d

                        SHA256

                        a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

                        SHA512

                        45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

                      • memory/852-0-0x0000000000400000-0x00000000004E4000-memory.dmp

                        Filesize

                        912KB

                      • memory/852-6-0x0000000000400000-0x00000000004E4000-memory.dmp

                        Filesize

                        912KB

                      • memory/852-2499-0x0000000000400000-0x00000000004E4000-memory.dmp

                        Filesize

                        912KB

                      • memory/3696-1661-0x0000000000400000-0x000000000071E000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/3696-2374-0x0000000000850000-0x0000000000851000-memory.dmp

                        Filesize

                        4KB

                      • memory/3696-8-0x0000000000400000-0x000000000071E000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/3696-2498-0x0000000000400000-0x000000000071E000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/3696-2489-0x0000000000400000-0x000000000071E000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/3696-5-0x0000000000850000-0x0000000000851000-memory.dmp

                        Filesize

                        4KB